Microsoft's own ransomware playbook describes what a real attacker does before anything gets encrypted, and it isn't what most people picture.
Three steps, straight from Microsoft: disable or uninstall your antivirus. Turn off security services and logging so nobody sees the activity. Find your backups and delete them. Only then does the ransom note show up.
Microsoft also notes they usually do this with legitimate programs already sitting on your machines, including the same remote support tools your IT guy installed for perfectly good reasons.
Think of antivirus as a smoke detector. It is very good at noticing a fire it recognizes. It does nothing about a person who walks in with a key, unscrews the detector, and takes their time.
That gap is the whole argument for managed detection and response. MDR is not a better scanner. It is someone watching behavior and able to act at 2am, when an account that only ever opens Word suddenly starts going folder by folder through your file server.
For a 15-attorney firm, the number that hurts is not the ransom. It is the week you cannot open a matter file, the depositions you reschedule, the billable hours that never come back, and the call you have to make to your largest client.
If your security line item still just says "antivirus," it's worth a look before your next cyber renewal.
Want the next one in your inbox?
One practical Microsoft 365, Copilot, Azure, or security move per week — plain English, no pitch.
Subscribe via email